DbDat

DbDat Db Database Assessment Tool DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is ...

scanginx

Scanginx Scanner For Nginx - Remote Integer Overflow Vulnerability Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

cheetah

English description | 中文说明 0x00 cheetah Cheetah is a dictionary-based brute force password webshell tool, running as fast as a cheetah hunt for prey. Cheetah's working principle is that it can submit a large number of detection passwords based on different web services at once, blasting efficienc...

CVE-2020-11022-CVE-2020-11023

CVE-2020-11022 CVE-2020-11023 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuer...

subbrute

subdomain-bruteforcer SubBrute SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting...

Telerik_CVE-2019-18935

TelerikUI Python 扫描器 telerikrcescan.py 示例 评估IP是否存在CVE-2019-18935漏洞 $ python3 telerikrcescan.py -t 192.168.44.21 评估主机名是否存在CVE-2019-18935漏洞 $ python3 telerikrcescan.py -t vulnerable.telerik.net 评估CIDR网络范围是否存在CVE-2019-18935漏洞 $ python3 telerikrcescan.py -r 23.253.4.0/24 评估目标列表 $ python3...

Taken

Taken 使用AWS未关联的弹性IP接管子域，并提供有效的子域接管概念验证（POC）。 通过子域接管可以做什么 - 窃取Cookie，如果Cookie的域属性设置为被劫持的子域。 发起CORS请求，如果Access-Control-Allow-Origin设置为被劫持的子域。 OAuth重定向获取授权码，如果被劫持的子域位于白名单中。 利用CSP策略进行XSS，如果CSP策略将该子域加入白名单。 点击劫持，如果X-Frame-Options将该子域加入白名单。 伪造邮件，如果SPF记录将该子域加入白名单。 自动化思路如下 获取子域。 进行反向查询，仅保存AWS IP。...

CVE-2025-29927

Advanced CVE-2025-29927 Vulnerability Scanner This is a professional-grade scanner designed to detect the CVE-2025-29927 middleware bypass vulnerability in Next.js applications. 🧠 What It Does Uses a real headless browser Playwright to deeply crawl a target website JS-rendered content included...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...

ssh-baseline

DevSec SSH Baseline This Compliance Profile ensures, that all hardening projects keep the same quality. https://github.com/dev-sec/puppet-ssh-hardening https://github.com/dev-sec/chef-ssh-hardening https://github.com/dev-sec/ansible-ssh-hardening Standalone Usage This Compliance Profile requires...

undici: undici: HTTP response splitting via retry interceptor

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

stackflow

stackflow 通用栈溢出利用工具 用法 root@kitploit: usage: ./stackflow.py OPTIONS optional arguments: -h, --help show this help message and exit -r RHOST, --rhost RHOST rhost -p RPORT, --rport RPORT rport -c CMDS, --cmds CMDS commands to send to server before overflow -v VULNCMD, --vulncmd VULNCMD vulnerable...

GTRS

GTRS - Google Translator Reverse Shell This tools uses Google Translator as a proxy to send arbitrary commands to an infected machine. root@kitploit: INFECTED MACHINE ==HTTPS== GOOGLE TRANSLATE ==HTTP== C2 Environment Configuration First you need a VPS and a domain, for the domain you can get a...

audit_couchdb

Audit CouchDB: 简单、清晰的CouchDB安全评估 Audit CouchDB是一个简单的工具，传递着强大的信息。给定一个Apache CouchDB URL，它会告诉你你想知道的所有关于其安全性的信息。 目标 Audit CouchDB将执行以下操作： 1. 了解关于该CouchDB的一切可能事实，例如： 服务器配置是什么？ 存在哪些用户账户？ 存在哪些用户角色？ 存在哪些数据库？ 在每个数据库中，安全设置是什么？ 在每个设计文档中，验证函数是什么？ 2. 根据这些事实，相互对比，并在发现安全隐患时发出警告，例如： 你显然没有费心去点击Futon数据库页面中的"安全"链接...

CVE-2019-1663-Binary-Analysis

Binary Analysis of CVE-2019-1663 Author: Corentin Wolff Origin of the Vulnerability Source of the Vulnerability The vulnerability originates from the function 0x0002BF64, which misuses the strcpy function, making it prone to buffer overflow attacks. For clarity, this function has been renamed to...

CVE-2025-2594

CVE-2025-2594 User Registration & Membership = 4.1.2 - Authentication Bypass Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available resources, research,...

CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaiten - a workflow management system, is vulnerable to unrestricted brute force attacks on user logins and email addresses registered in the system via a simple POST request. References: CVE MITRE Description NVD CVE Usage Simple download bash script and ru...

XSS2Shell-CVE-2026-64638

🔍 @Mr-LeonardoGomes 💀 XSS2Shell-CVE-2026-64638 Escáner multiobjetivo XSS2Shell Desarrollador: Crédito: YogaGymn Utilidad PoC/escaneo para pruebas de seguridad autorizadas en WordPress. El proyecto contiene un flujo de explotación para un único objetivo y un modo solo escaneo multiobjetivo...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

Grawler

Grawler - v1.0 This project isnot maintained anymore. Grawler is the best tool ever, made for automating google dorks it's a tool written in PHP which comes with a web interface that automates the task of using google dorks, scrapes the results, and stores them in a file, version 1.0 is the more...